Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(wasm): add user id to wasm cache file hash #301

Merged
merged 2 commits into from
Jul 7, 2024

Conversation

burmecia
Copy link
Member

@burmecia burmecia commented Jul 7, 2024

What kind of change does this PR introduce?

This PR is to add current user id and package url to wasm fdw local cache file name hash, which is to mitigate a security issue described below.

What is the current behavior?

The current wasm fdw local cache file name hash is calculated as sha256('<pacakge_name>@<version>'), this will cause a potential security risk. Suppose both user A and B can create foreign table on same database, and then below steps can cause data leaking:

  1. user A create a normal foreign table using package_name=foo, version=1.2.3, but doesn't query it so the wasm fdw file hasn't been downloaded yet
  2. user B made a malicious wasm fdw with the same package name foo and version 1.2.3, this wasm fdw used the same code as user A used, but added an secret code which can post every response to user B controlled data collection site
  3. user B published this malicious wasm fdw to a public website
  4. user B created another normal foreign table using package_name=foo, version=1.2.3, and package url pointing to his wasm fdw
  5. user B query his foreign table so the malicious wasm file is downloaded to local cache
  6. when user A queries his foreign table, because the cache file name hash is same as user B's wasm fdw, the local malicious wasm file will be loaded and used, thus user A's data is leaked to user B.

What is the new behavior?

The wasm fdw local cache file name hash will be changed to sha256('<user_oid>:<package_ur>:<pacakge_name>@<version>'), so each user will use their own local cache file and will not shared with other users. This will mitigate the vulnerability described above.

Additional context

After database backup/restore, the user oid may change so the local cache file name hash will be changed, this will trigger another download. That's expected behaviour so we don't need to worry about it.

@burmecia burmecia added bug Something isn't working wasm labels Jul 7, 2024
@burmecia burmecia requested a review from imor July 7, 2024 04:47
@burmecia burmecia merged commit 3ecda9e into main Jul 7, 2024
2 checks passed
@burmecia burmecia deleted the bo/fix/wasm-cache-filename branch July 7, 2024 08:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working wasm
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants